Unauthorized Access in AzuraCast Web Radio Management Suite
CVE-2025-67737

3.1LOW

Key Information:

Vendor

Azuracast

Status
Azuracast
Vendor
CVE Published:
12 December 2025

What is CVE-2025-67737?

AzuraCast, a self-hosted web radio management suite, contains an improper access control vulnerability where an unintended API endpoint designed for internal use is exposed to the public. This flaw exists in version 0.23.1, allowing users with specific internal knowledge to craft HTTP requests that manipulate the database contents of a station. An attacker must possess a valid SFTP station username and internal filesystem knowledge to exploit this vulnerability. The issue has been addressed in version 0.23.2.

Affected Version(s)

AzuraCast < 0.23.2

References

https://github.com/AzuraCast/AzuraCast/security/advisorie...
x_refsource_CONFIRM
https://github.com/AzuraCast/AzuraCast/commit/34620dbad93...
x_refsource_MISC

CVSS V3.1

Score:
3.1
Severity:
LOW
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2025-67737 : Unauthorized Access in AzuraCast Web Radio Management Suite